Privacy Policy

What we collect

Only what running the shop requires. There is no advertising, no profile built about you, and no tracking of you across other websites.

Your account

• Email address — this is how your account is identified and how purchases find their way to you.
• Name and profile picture — only if you sign in with Google, and only what Google returns.
• Password — optional, and never stored as you typed it. We keep a scrypt hash, which cannot be reversed into your password.

Visits

• The page you opened, with the country the request came from, the kind of device, and the site that linked you here — the site, not the address, so a search never tells us what you searched for.
• A random number in a cookie, so four pages read in one sitting count as one visitor instead of four. It is not your name, your email or your IP, and it means nothing anywhere else.

We count this ourselves, on our own servers, to see which templates draw interest. If you are signed in, the visit is linked to your account.

Security records

• IP address and browser, recorded against each sign-in session and each template you download or copy.
• Failed purchase-verification attempts, with the email and IP used.

These exist to stop someone guessing licence keys and to make a shared or stolen account obvious. They are not used to build a picture of you.

Purchases

• The email used at checkout, the amount, the currency and the date.
• Identifiers issued by the payment provider, so a refund can be matched to an order.

We never see or store your card details. Card entry happens entirely on the payment provider's own checkout page. Nothing about your card reaches our servers.

Who else handles it

Each of these is used for one job, and receives only what that job needs.

• Stripe and Lemon Squeezy — taking payment. They receive your email and payment details directly.
• Supabase — the database and file storage, hosted in Singapore.
• Vercel — hosting and delivery of the site.
• Emailit — sending sign-in links and purchase confirmations. Receives your email address and the message.
• Google — only if you choose to sign in with Google. We request your name, email and picture, and nothing else. We do not keep any Google access token.

We do not sell your information, and we do not share it with anyone beyond the companies above.

Cookies

One cookie keeps you signed in. One holds the random number that counts your visit, and lasts a year. Two short-lived ones exist only while a Google sign-in is in progress and are deleted the moment it finishes. None of them advertise to you or follow you to other sites.

How long we keep it

• Account and purchase records stay while your account exists — a purchase is proof of what you own.
• Sign-in sessions expire after 30 days, or immediately when you sign out.
• Sign-in links expire after 15 minutes and work once.
• Visit records outlive an account, but deleting yours strips your name from them — what is left is a page and a date.

Your choices

• Change your name, set or remove a password, and end every session from your account page.
• Ask for a copy of everything we hold about you, or ask us to delete your account, by writing to support@geniusflow.net.

Deleting your account removes your access to anything you bought. We may keep a minimal record of the transaction itself where tax or accounting rules require it.

Contact

Questions about any of this go to support@geniusflow.net.